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REMARKS 

Claims 5-20 are pending in the present application. Claims 1-4 and 12-14 are 
canceled, claims 7-10 are amended, and claims 21-27 are added. Reconsideration of the 
claims is respectfully requested. 

L Interview Sammary 

On April 6, 2005, the examiner and the undersigned attorney discussed whether 
Bolmarcich is prior art. No agreement was reached. 

II. 35 U.S>C> S 102. Anticipation 

The examiner rejects claims 1-4 under 35 U.S.C § 102(e) as anticipated by 
Yavatkar et al.^, Method and System for Diagnosing Network Intrusion. U.S, Patent 
6,735,702 (May 1 1, 2004), Applicants have canceled claims 1 -4, thereby rendering the 
rejection moot. Applicants reserve the right to argue for patentability of these claims in a 
continuation application. 

m. 35 U.S-C- S 103. Obviousness 

The examiner rejects claims 5-15, 1 8 and 20 under 35 U.S.C. § 103(a) as obvious 
over Yavatkar in view of Bolmarcich et al.. System and Method for EstablisMng Direct 
Communication Between Parallel Programs . U.S. Patent 6,539,435 (Mar. 25, 2003), In 
addition, the. examiner rejects claim 16 as obvious over Yavatkarsin view of Bolmarcich, 
further in view of "Network Dispatcher: A Connection Router for Scalable Intemet 
Services'' (Hunt, G. et al, ''Network Dispatcher: A Connection Router for Scalable 
Intemet Services", Proceedings of the 7^ International World Wide Web Conference 
Online , April 1998; unizh.home/mazz»/reports/www7conC'fullpaperes/1899/coml899 
(hereinafter In addition, the examiner rejects claim 17 as obvious over Yavatkar 

in view of Bolmarcich^ in further view of Skanklin et al., Parallel Intrusion Detection 
Sensors with Load Balancing for High Speed Networks . U.S. Patent 6,578,147 (Jun. 10, 
2003). The examiner also rejects claim 19 as obvious over Yavatkar in view of 
Bolmarcich, in ftuther view of **Network- vs. Host-based Intrusion Detection: A Guide to 
Intrusion Detection Technology" f ISS Net . October 2, 1998; 
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(documents.iss.netAvhitepapers/nvh-ids.pdf) (hereinafter "NVHIDS'y These rejections 
are respectfiilly traversed. 

Bolmarcich is not prior art for purposes of an obviousness rejection. Thus, the 
examiner has failed to state prima facie obviousness rejections. 

Bolmarcich qualifies for the exception provided under 35 U.SC § 103(c). 

Bolmarcich only qualifies as a reference under 35 U.S.C. § 102(e) because the filing date 

of the present application, July 27, 2001 is before the earliest publication date for 

Bolmarcich, September 12, 2002. In addition, both Bolmarcich and the claimed 

inventions were, at the time the invention was made, owned by the same person or 

subject to an obligation of assignment to the same person (International Business 

Machines Corporation). The relevant text of 35 U.S.C. § 103(c) provides as follows: 

(c)(1) Subject matter developed by another person, which qualifies 
as prior art only xmder one or more of subsections (e), (f), and (g) 
of section 102 of this title, shall not preclude patentability under 
this section where the subject matter and the claimed invention 
were^ at the time the invention was madej owned by the same 
person or subject to an obligation of assignment to the same 
person. 

When the above facts are read in view of this law, it is apparent that Bolmarcich 
cannot be used to preclude patentability of the claims. Accordingly, Bolmarcich is not 
prior art. Because a]l of the obviousness rejections in some way rely on Bolmarcich^ 
AppUcants respectfiilly request that the withdrawal of the obviousness rejections and 
allowance of the corresponding claims. 

IV, Objection to Claims 

The examiner objects to claims 7-10 due to informalities in the claims. 
AppUcants have amended these claims accordingly. 

V. New Claims 

Applicants have added claims 21-27. Claims 21-24 claim a method of detecting a 
network attack that corresponds with the method described in Figure 5. Claims 25-27 
claim an apparatus for perfomiing the method described in claim 25. Support for claims 
21-27 may be found in Figure 5 and on pages 10 and 1 1 of the specification. No new 
matter is added. 
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Claims 21-27 should be allowable over the references the examiner cites. Claim 
21 is as :follows: 

21 . A method of identifyi ng the entry point of an attack upon a 
device protected by an intnisioti detection system, said device one 
of a plurality of devices cormected by a network, the method 
comprising the computer-implemented steps of: 
detecting an attack on the device; 
notifying a correlation engine of the attack on the device; 
obtaining intrusion information regarding the attack; 
obtaining network infonnation regarding the attack; 
usttig the correlation engine, correlating the intrusion 

information and the network information to produce 
correlation information; 
using the correlation information, finding on the network a 

logical port of coimection used by the attack; and 
mapping the logical port on the network to a physical port 
on the network using the correlation engine. 
None of the references show or suggest a correlation engine or using the correlation 

engine as claimed. None of the references show mapping a logical port to a physical port 

using a correlation engine as claimed. Thus, none of the references anticipate claims 21- 

27. Similarly, claims 21-27 are non-obvious in view of the references when considered 

individually or in combination. Thus, claims 21-27 should be allowable over the cited 

references. 
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VL Conclusion 

It is respectfully urged that the subject application is patentable over the cited 
references and is now in. condition for allowance. 

The examiner is invited to call the undersigned at the below-listed telephone 
number if in the opinion of the examiner such a telephone confidence would expedite or 
aid the prosecution and examination of this application. 



DATE: 



Respectfully submitted, 

TheodorAJb. Fay, III 
Reg. No. 48,504 
Yee & Associates, P.C. 
P.O. Box 802333 
Dallas, TX 75380 
(972) 385-8777 
Attorney for Applicants 
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